/*
    创建时间：2023年05月10日
    创建人：指尖上的故事
    官网：https://sec-scan.srcbug.net
 */
using System;
using System.Collections.Generic;
using System.Linq;
using System.Management;
using System.Text;
using System.Threading.Tasks;

namespace Sec_scan系统防火墙.Service
{
    public class Sec_Registry_Service
    {
        public static string RegistryCode(string regis)
        {
            // 创建 WMI 查询语句
            string query = "SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY_USERS'";

            // 创建 ManagementEventWatcher 对象
            ManagementEventWatcher watcher = new ManagementEventWatcher(new WqlEventQuery(query));

            // 注册事件处理程序
            watcher.EventArrived += RegistryKeyChangeEventHandler;

            // 开始监听
            watcher.Start();

            Console.WriteLine("正在监听系统用户注册表变化，请按任意键停止...");
            Console.ReadKey();

            // 停止监听
            watcher.Stop();
            return regis;
        }
        static void RegistryKeyChangeEventHandler(object sender, EventArrivedEventArgs e)
        {
            // 获取注册表更改事件的相关信息
            PropertyData eventData = e.NewEvent.Properties["TargetInstance"];

            if (eventData != null && eventData.Value is ManagementBaseObject)
            {
                ManagementBaseObject targetInstance = (ManagementBaseObject)eventData.Value;
                string eventName = e.NewEvent.ClassPath.ClassName;
                string hive = targetInstance["Hive"].ToString();
                string keyPath = targetInstance["KeyPath"].ToString();
                string eventNameSpace = targetInstance["__NAMESPACE"].ToString();

                Console.WriteLine($"注册表发生了变化：\n事件名称：{eventName}\n命名空间：{eventNameSpace}\nHive：{hive}\n路径：{keyPath}");
                // 执行自定义逻辑
            }
        }
    }
}
